Actively exploited vulnerabilities affecting Notepad++ products.https://wildfortech.comhttps://wildfortech.com/security#CVE-2025-15556https://wildfortech.com/security#CVE-2025-15556Notepad++'s built-in WinGUp update mechanism fails to verify the integrity of downloaded update packages. An attacker positioned to intercept or redirect that update traffic — for example, via a network-based man-in-the-middle attack — could substitute a malicious installer, resulting in arbitrary code execution under the victim's account privileges. Because Notepad++ is widely deployed across enterprise environments, this supply-chain-style attack path poses meaningful risk to large numbers of users.Thu, 12 Feb 2026 00:00:00 GMTNotepad++Notepad++